rapid7/metasploit-framework — pull request #1474 by smilingraccoon (2013-02-10 20:29:49+00:00)
Title: added s4u_persistence.rb

Added a persistence module based on task scheduler and service-for-user based on scriptjunkies blog: http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/

For more info: http://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/

I found these settings work well for testing xpath advanced opt, will trigger on "nmap -sV -p 3389 x.x.x.x" but the event only triggers once an hour or so.
set EVENT_ID 56
set EVENT_LOG System
set XPATH *[EventData[Data = \'\']]